Static task
static1
Behavioral task
behavioral1
Sample
ed934e793614032cc0f74493e1b45a1c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed934e793614032cc0f74493e1b45a1c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ed934e793614032cc0f74493e1b45a1c_JaffaCakes118
-
Size
399KB
-
MD5
ed934e793614032cc0f74493e1b45a1c
-
SHA1
0f2e86fa016cf31e358b139b9bbc9dbab82a44b2
-
SHA256
601788b573d00ed983f633d0d9d446228ea5f6f251e6b3c95c33437fb7feaa93
-
SHA512
9c634e428859d1587d11a5717dc1d54dfb8c1ebe8a610df86cd1b0cd04db24dbb486650ff5fea8821885c67c645cab71859866b6dc982ed139ddc6c3a2616587
-
SSDEEP
3072:fg62RRVEDcAJ1pCV/FL+svRn6OP+xdBzt1tsatz7gMjI:fX2NEPXQ/Ye+BzBsh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed934e793614032cc0f74493e1b45a1c_JaffaCakes118
Files
-
ed934e793614032cc0f74493e1b45a1c_JaffaCakes118.exe windows:4 windows x86 arch:x86
168aecddd46e49bab5e36f7feba40f71
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
FindNextFileA
FindFirstFileA
ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
user32
RegisterClassExA
LoadCursorA
LoadStringA
UpdateWindow
ShowWindow
CreateWindowExA
PostQuitMessage
EndPaint
DrawTextA
GetClientRect
BeginPaint
DialogBoxParamA
DestroyWindow
DefWindowProcA
EndDialog
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
msvcrt
strlen
strcat
strcpy
memcpy
strrchr
Sections
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE